fix(mtls): Fix EndpointContext's determineEndpoint logic to respect env var

Author: andyrzhao

gax-java/gax/src/main/java/com/google/api/gax/rpc/EndpointContext.java

@@ -292,17 +292,22 @@ private String determineEndpoint() throws IOException {
               ? CertificateBasedAccess.createWithSystemEnv()
               : certificateBasedAccess();
       MtlsProvider mtlsProvider = mtlsProvider();
-      if (mtlsProvider == null) {
-        try {
-          mtlsProvider = DefaultMtlsProviderFactory.create();
-        } catch (CertificateSourceUnavailableException e) {
-          // This is okay. Leave mtlsProvider as null;
-        } catch (IOException e) {
-          LOG.log(
-              Level.WARNING,
-              "DefaultMtlsProviderFactory encountered unexpected IOException: " + e.getMessage());
+
+      // Only attempt to create a default MtlsProvider if client certificate usage is enabled.
+      if (certificateBasedAccess.useMtlsClientCertificate()) {
+        if (mtlsProvider == null) {
+          try {
+            mtlsProvider = DefaultMtlsProviderFactory.create();
+          } catch (CertificateSourceUnavailableException e) {
+            // This is okay. Leave mtlsProvider as null;
+          } catch (IOException e) {
+            LOG.log(
+                Level.WARNING,
+                "DefaultMtlsProviderFactory encountered unexpected IOException: " + e.getMessage());
+          }
         }
       }
+
       // TransportChannelProvider's endpoint will override the ClientSettings' endpoint
       String customEndpoint =
           transportChannelProviderEndpoint() == null